CompTIA JK0-022 Online Practice Questions and Exam Preparation

CompTIA JK0-022 Online Questions & Answers

• Question 831:

  A security administrator wants to test the reliability of an application which accepts user provided parameters. The administrator is concerned with data integrity and availability. Which of the following should be implemented to accomplish this task?

  A. Secure coding
  B. Fuzzing
  C. Exception handling
  D. Input validation
  B. Fuzzing

  ---

  Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks. Incorrect Answers: A: Proper and secure coding can prevent many attacks, including cross-site scripting, SQL injection and buffer overflows. C: Exception handling is an aspect of secure coding. When errors occur, the system should revert back to a secure state. This must be coded into the system by the programmer, and should capture errors and exceptions so that they could be handled by the application. D: Input validation is an aspect of secure coding and is intended to mitigate against possible user input attacks, such as buffer overflows and fuzzing. Input validation checks every user input submitted to the application before processing that input. The check could be a length, a character type, a language type, or a domain. References: http://en.wikipedia.org/wiki/Fuzz_testing Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 218, 257 Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 229, 319, 320

• Question 832:

  A security technician has been asked to recommend an authentication mechanism that will allow users to authenticate using a password that will only be valid for a predefined time interval. Which of the following should the security technician recommend?

  A. CHAP
  B. TOTP
  C. HOTP
  D. PAP
  B. TOTP

  ---

  Time-based one-time password (TOTP) tokens are devices or applications that generate passwords at fixed time intervals. Therefore, the password will only be valid for a predefined time interval. Incorrect Answers: A: The Challenge-Handshake Authentication Protocol (CHAP) is used primarily over dial-up connections to provide a secure transport mechanism for logon credentials. C: HMAC-based one-time password (HOTP) tokens are devices that generate passwords based on a nonrepeating one-way function. It is not restricted to time. D: PAP allows for two entities to share a password in advance and use the password as the basis of authentication. It is not dependant on time. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 282, 283. http://en.wikipedia.org/wiki/Password_authentication_protocol#Working_cycle

• Question 833:

  Corporate IM presents multiple concerns to enterprise IT. Which of the following concerns should Jane, the IT security manager, ensure are under control? (Select THREE).

  A. Authentication
  B. Data leakage
  C. Compliance
  D. Malware
  E. Non-repudiation
  F. Network loading
  B. Data leakage
  C. Compliance
  D. Malware

  ---

  In a joint enterprise, data may be combined from both organizations. It must be determined, in advance, who is responsible for that data and how the data backups will be managed. Data leakage, compliance and Malware issues are all issues concerning data ownership and backup which are both impacted on by corporate IM. Incorrect Answers: A: Authentication is more concerned with legitimate, authorized access E: Nonrepudiation prevents one party from denying actions that they carried out and in the electronic world nonrepudiation measures can be a two-key cryptographic system and the involvement of a third party to verify the validity. This respected third party `vouches' for the individuals in the two-key system. F: Networking loading would be a load balancing/ redundancy concern. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, pp 262, 397

• Question 834:

  An auditor is given access to a conference room to conduct an analysis. When they connect their laptop's Ethernet cable into the wall jack, they are not able to get a connection to the Internet but have a link light. Which of the following is MOST likely causing this issue?

  A. Ethernet cable is damaged
  B. The host firewall is set to disallow outbound connections
  C. Network Access Control
  D. The switch port is administratively shutdown
  C. Network Access Control

  ---

  Network Access Control (NAC) means controlling access to an environment through strict adherence to and implementation of security policies. The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control. Incorrect Answers: A, B, D: In all three cases, a link light would not be showing. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, p 40.

• Question 835:

  Several users report to the administrator that they are having issues downloading files from the file server. Which of the following assessment tools can be used to determine if there is an issue with the file server?

  A. MAC filter list
  B. Recovery agent
  C. Baselines
  D. Access list
  C. Baselines

  ---

  The standard configuration on a server is known as the baseline. In this question, we can see if anything has changed on the file server by comparing its current configuration with the baseline. The IT baseline protection approach is a methodology to identify and implement computer security measures in an organization. The aim is the achievement of an adequate and appropriate level of security for IT systems. This is known as a baseline. A baseline report compares the current status of network systems in terms of security updates, performance or other metrics to a predefined set of standards (the baseline). Incorrect Answers: A: A MAC filter list is a list of allowed or disallowed MAC addresses on a device that uses MAC filtering, for example, a network switch or a wireless access point. It is not used to determine if there is an issue with a file server. Therefore, this answer is incorrect. B: A recovery agent is a `master' account that can recover access to files or other encrypted data in the event of a lost or corrupted digital certificate. In the example of EFS (Encrypted File System), the recovery agent can unencrypt encrypted files if the user's certificate that was used to encrypt the files is unavailable. A recovery agent is not used to determine if there is an issue with a file server. Therefore, this answer is incorrect. D: An access list is a list of authorized users or computers allowed to access a resource. It is not used to determine if there is an issue with a file server. Therefore, this answer is incorrect. References: http://en.wikipedia.org/wiki/IT_baseline_protection

• Question 836:

  The network security engineer just deployed an IDS on the network, but the Chief Technical Officer (CTO) has concerns that the device is only able to detect known anomalies. Which of the following types of IDS has been deployed?

  A. Signature Based IDS
  B. Heuristic IDS
  C. Behavior Based IDS
  D. Anomaly Based IDS
  A. Signature Based IDS

  ---

  A signature based IDS will monitor packets on the network and compare them against a database of signatures or attributes from known malicious threats. Incorrect Answers: B, C: The technique used by anomaly-based IDS/IPS systems is also referred as network behavior analysis or heuristics analysis. D: An IDS which is anomaly based will monitor network traffic and compare it against an established baseline. The baseline will identify what is "normal" for that network- what sort of bandwidth is generally used, what protocols are used, what ports and devices generally connect to each other- and alert the administrator or user when traffic is detected which is anomalous, or significantly different, than the baseline. References: https://technet.microsoft.com/en-us/library/dd277353.aspx http://en.wikipedia.org/wiki/Intrusion_detection_system#Signature-based_IDS http://en.wikipedia.org/ wiki/Intrusion_detection_system#Statistical_anomaly-based_IDS

• Question 837:

  A network technician is on the phone with the system administration team. Power to the server room was lost and servers need to be restarted. The DNS services must be the first to be restarted. Several machines are powered off. Assuming each server only provides one service, which of the following should be powered on FIRST to establish DNS services?

  A. Bind server
  B. Apache server
  C. Exchange server
  D. RADIUS server
  A. Bind server

  ---

  BIND (Berkeley Internet Name Domain) is the most widely used Domain Name System (DNS) software on the Internet. It includes the DNS server component contracted for name daemon. This is the only option that directly involves DNS. Incorrect Answers: B: Apache is the most widely used web server software. It is not specifically required for DNS. C: Microsoft Exchange Server is calendaring software, a mail server and contact manager developed by Microsoft. It is not specifically required for DNS. D: RADIUS is a networking protocol that delivers consolidated Authentication, Authorization, and Accounting (AAA) management for users who connect and make use of a network service. It is not specifically required for DNS. References: http://en.wikipedia.org/wiki/BIND http://en.wikipedia.org/wiki/RADIUS http://en.wikipedia.org/wiki/Microsoft_Exchange_Server http://en.wikipedia.org/wiki/Apache_HTTP_Server

• Question 838:

  A security analyst needs to ensure all external traffic is able to access the company's front-end servers but protect all access to internal resources. Which of the following network design elements would MOST likely be recommended?

  A. DMZ
  B. Cloud computing
  C. VLAN
  D. Virtualization
  A. DMZ

  ---

  A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall. Incorrect Answers: B: Cloud computing is a popular term that refers to performing processing and storage elsewhere, over a network connection, rather than locally. C: A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. VLANs are used for traffic management. VLANs can be used to isolate traffic between network segments. D: Virtualization offers several benefits, such as being able to launch individual instances of servers or services as needed, real-time scalability, and the ability to run the exact OS version required for a certain application. References: Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp 23, 37, 39.

• Question 839:

  After a company has standardized to a single operating system, not all servers are immune to a well- known OS vulnerability. Which of the following solutions would mitigate this issue?

  A. Host based firewall
  B. Initial baseline configurations
  C. Discretionary access control
  D. Patch management system
  D. Patch management system

• Question 840:

  Pete, a security analyst, has been informed that the development team has plans to develop an application which does not meet the company's password policy. Which of the following should Pete do NEXT?

  A. Contact the Chief Information Officer and ask them to change the company password policy so that the application is made compliant.
  B. Tell the application development manager to code the application to adhere to the company's password policy.
  C. Ask the application development manager to submit a risk acceptance memo so that the issue can be documented.
  D. Inform the Chief Information Officer of non-adherence to the security policy so that the developers can be reprimanded.
  B. Tell the application development manager to code the application to adhere to the company's password policy.

  ---

  Since the application is violating the security policy it should be coded differently to comply with the password policy. Incorrect Answers: A: Changing the password policy to make the application compliant would be the same as creating an incident because any attempt to violate a security policy is considered an incident. C: Requesting to change to the risk acceptance is not best practice and it basically amounts to incident response. D: Reprimanding the developers will nor result in the application complying with the security policy. References: Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, Sixth Edition, Sybex, Indianapolis, 2014, p 445